Organizing OpenWrt Interfaces and Firewall Zones

OpenWrt firewall design is not only about ports: a zone is a policy boundary for one or more interfaces. I use separate lan, wan, and guest interfaces so IoT clients cannot initiate connections into the management LAN.

Prepare

Identify interfaces with uci show network, firewall zones with uci show firewall, and routes before editing. Do not copy a random configuration because bridge and VLAN names depend on the target and release.

Minimum design

• lan: allow router access and forwarding to wan.
• wan: reject new inbound connections and allow only established/related traffic.
• guest: forward to the Internet but not to lan; allow DNS/DHCP to the router only deliberately.

After editing through LuCI or UCI, run fw4 print on firewall4/nftables systems or inspect iptables-save on older releases. From a guest client verify the right subnet, DNS, and Internet access, while management LAN pages remain unreachable.

Warning

A broad WAN ACCEPT rule can expose LuCI or SSH. Avoid 0.0.0.0/0 plus every port unless the traffic direction is understood, and keep a console or recovery path for remote policy changes.

Source

OpenWrt Firewall and network interfaces .